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INTRODUCTION 


Regulators around the world are responding quickly 
to the rapidly evolving financial technology, or 
fintech, landscape. New or emerging financial 
products, services or delivery channels may not 
meet all regulatory requirements. As a solution 

to this, financial regulators internationally have 
implemented fintech regulatory sandbox regimes. 
In some jurisdictions, although sandboxes have 
not been established, regulators have nonetheless 
sought to put in place a supportive regulatory 
environment. 


In a nutshell, against the backdrop of whether 
innovation meets regulatory requirements, a 
sandbox allows financial institutions (FI) to test 
their products, services or solutions in the market 
under a more relaxed regulatory environment but 
within a well-defined space and duration agreed 
with the regulators. 


This guide provides an overview and comparison 

of the regulatory sandbox regimes internationally, 
covering the Asia Pacific, EMEA and Americas 
regions. A number of jurisdictions such as Belgium, 
the Philippines and South Africa have quasi/bespoke 
sandboxes, while Argentina and Germany have no 
formal sandbox. 
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Applications for a six-month “pilot” testing program 
opened in February 2019 and 44 applications were 
Submitted across 17 participating regulators, with 

a number focusing on the areas of regtech and 
cryptoassets. Of those, eight firms proceeded 

to an initial cross-border trial including: 


ο a technology company which permits consumers 
to control a “verified identity Digital ID" and 
transfer that ID between firms for KYC purposes 


ο a behavioral sciences company which uses machine 
learning to help users to mitigate culture and 
conduct risks 


ο a platform using distributed ledger technology 
which enables cross-border transactions in a variety 
of products, including commodities, smart contracts 
and escrows 


Firms that applied to participate in the pilot test were 
required to meet the application requirements of all the 
jurisdictions in which they would like to test. For example, 
a firm applying to Australia, Singapore and the United 
States would have to satisfy the application requirements 
of the Australian Securities and Investments Commission, 
the Monetary Authority of Singapore and the Consumer 
Financial Protection Bureau, respectively. 


What are the main benefits of the sandbox? 


The GFIN permits firms to apply jurisdictional scaling from 
day one and is therefore more convenient for those firms 
which operate across jurisdictions. Of course, prior to the 
GFIN firms could have applied for entry into multiple 
sandboxes at the same time, although they would not 
have a coordinated response from the relevant regulators, 
and would not have been able to test their services on a 
cross-border basis. As the GFIN project includes information 
sharing and development of best practice, we expect 
participant regulators to develop a more “joined-up" 
approach to the regulation of cross-border services. 

This is a welcome development and may reduce regulatory 
barriers to cross-border growth in the future. 
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FAQS ON FINTECH REGULATORY SANDBOXES 


o] Who can apply to be in the sandbox? 


What are some of the examples of how Fls may 
benefit from the sandbox? 


Please refer to question 2. 


How to apply to be in the sandbox? 


There was a one-month application period for a pilot 
phase of cross-border testing in February 2019. The GFIN 
has not yet released its plans for further sandbox cohorts. 


When to apply to be in the sandbox? 


Please refer to question 3. 


What are the evaluation criteria? 


As described above, firms wishing to participate 

are required to meet the application requirements 

of all the jurisdictions in which they would like to test. 
For the cross-border testing pilot, applications are 
assessed on a case-by-case basis, with each regulator 
considering whether an applicant's proposed tests 
meet its individual screening criteria, areas of interest 
and ability to support the proposed activity. Firms 
engage with the relevant regulators to develop testing 
plans, after which they proceeded to take part in the 
pilot testing phase. None of the 2019 intake was in the 
event able to satisfy each relevant regulator's criteria. 
The GFIN is exploring how it may nevertheless assist 
these firms. 


It may be the case that following the pilot testing 
period the GFIN members develop a more harmonious 
evaluation criteria, although that remains to be seen. 
At a minimum, each regulator will look to ensure that 
applicants will be able to adhere to the appropriate 
Safeguards for their jurisdiction. 


It is notable that the GFIN has indicated it looks 
forward to receiving applications from firms other 
than those operating in the areas of regtech and 
cryptoassets in the future. 
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How long will the regulators take to process 
sandbox application? 


It is difficult to give a precise figure due to the limited 
time the GFIN has been running. Applications for the 
testing period were due by 28 February 2019 and the 
GFIN announced the eight firms to undergo testing at 
the end of April 2019, although this may change for 
future sandbox cohorts. 


What is the duration of the sandbox? 


Pilot tests are run for a six-month period, unless 
regulators agree to extend them. 


What happens after the sandbox? 


This will vary from country to country in which the 
product is offered. 


10 Any other issues to be mindful of? 


Prior to the GFIN, firms were unable to pilot their 
innovative business models on a cross-border basis. 
This would necessarily have confined potential 
sandbox applicants to business models that focused on 
a particular jurisdiction, with the option of “scaling up” 
after going through the sandbox process. 
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Who can apply to be in the sandbox? 


Currently there are no laws, rules or regulations 
specifically governing the establishment or the conduct 
of regulatory sandboxes in Argentina for the banking 
and finance regulatory market. The policy of Argentina 
regarding fintech companies has not changed in recent 
years, i.e., not to regulate the sector beyond current 
applicable consumer protection laws and other industry 
specific regulations. 


The previous administration of President Macri 
maintained an open approach to firms or entities seeking 
to offer fintech products or services to consumers, 
despite lobbying by local financial entities. The Argentine 
government has maintained this open approach mainly 
for three reasons: (i) to facilitate the use and access of 
[Tl-based means of payment to the entire population 
(there is still a big proportion of the population without 
access to banking products); (ii) to combat money- 
laundering activities, and (iii) to facilitate the provision 
of credit to consumers. 


The Argentine Central Bank (“Central Bank") has not 
intervened nor regulated the activities conducted by 
fintech companies. The Central Bank's by-laws specifically 
include the capacity and authority to regulate fintech 
companies. Nevertheless, no specific license or regulation 
has been issued in this regard. On the contrary, fintech 
companies have publicly offered products to end 
consumers by issuing pre-paid cards, in-app payments 
services, accepting funds for clients’ online accounts 

and granting loans without performing financial 
intermediation, and therefore, without the need to 
obtain a banking license. Furthermore, the Central Bank 
has recently granted a banking license to the first 100% 
online bank (with no offices to serve clients). 


What are the main benefits of the sandbox? 


The Argentine Securities Commission (ASC) has also 
recently presented a workspace that focuses on financial 
innovation in the capital market. The workspace was 
created following a meeting that involved regulators, 
private entities, the Financial Information Unit (the 
national center for the receipt and analysis of information 
relevant to money laundering), the Central Bank, the 
Ministry of Finance and the Ministry of Production. 

One of the key points arising was the need to create 

a sandbox space for fintech. The Central Bank has 

also taken similar action in this respect by creating a 
workspace focused on IT payment infrastructure and 
alternative credit and saving channels. The Financial 
Information Unit has updated its regulation to include 
various fintech companies that were not previously 
regulated for money laundering, such as payment 
processing companies. 


6 | International Guide to Regulatory Fintech Sandboxes 


FAQS ON FINTECH REGULATORY SANDBOXES 
κακαὶ ARGENTINA 


What are some of the examples of how FIs may 
benefit from the sandbox? 


N/A 


How to apply to be in the sandbox? 


N/A. 


When to apply to be in the sandbox? 


Ν/Α. 


What are the evaluation criteria? 


Ν/Α. 


How long will the regulators take to process 
sandbox application? 


N/A. 


What is the duration of the sandbox? 


N/A. 


What happens after the sandbox? 


N/A. 


Any other issues to be mindful of? 


The Central Bank is expected to regulate at least, in 
part, this business space at some point in the future. 
In this context, note, however, that depending on 

the proposed activity, the Central Bank or the ASC 
may require prior license or registration. Therefore, a 
detailed analysis of the activity should be carried out 
in advance. In general, the Central Bank will intervene 
if it considers that the fintech activity consists in 
performing financial intermediation (i.e., taking funds 
as deposits from the general public and granting loans 
with such funds) or issuing credit cards. The ASC will 
in turn intervene to protect consumers (investors) if 
the fintech is raising money from the public to make 
investments or performing securities intermediation 
activities. In this regard, for example, Law No. 27349 
created the concept of “Collective Financing Platforms” 
(Plataformas de Financiamiento Colectivo) aimed at 
regulating crowdfunding activities. This law can be 
considered as an exception to the “no regulation” 
standing, and was aimed at regulating new investment 
platforms that were not previously regulated, with 
the purpose of creating a safe environment to allow 
consumers to invest their savings. 


AUSTRALIA 


i] Who can apply to be in the sandbox? 


Fintech businesses that meet certain eligibility criteria, 
who are looking to provide financial services or engage 
in credit activities, and are likely to be regulated by the 
Australian Securities and Investments Commission (ASIC). 


Australia's regulatory sandbox is based on three key 
components, designed to allow businesses to test 
products and services without holding the usual 
Australian financial services license (AFSL) or Australian 
credit license (ACL). These three components are: 


e relying on existing flexibility in the regulatory 
framework or exemptions provided by the law 
which mean that a license is not required 


ο ASIC's specific fintech licensing exemption 
(described below) 


ο tailored, individual licensing exemptions granted by 
ASIC to a particular business to facilitate product or 
service testing 


To rely on the current fintech licensing exemption, 
businesses must only be providing advice, dealing 

in, or distributing products. Businesses cannot issue 
their own product (including lending to consumers) or 
operate a managed investment scheme. Additionally, 
the business must: 


e not already be licensed or be a related body 
corporate of a licensee 


ο not be an unregistered foreign company 


e have no more than 100 retail clients (unlimited 
wholesale clients) | 


e plan to test for no more than 12 months 


ο have a total client exposure not exceeding 
AUD 5 million 


ο comply with consumer protection requirements 


e have adequate compensation arrangements 
(such as professional indemnity insurance) 


e have both internal and external dispute resolution 
procedures in place 


The products a business may advise on or distribute is 
limited to: 


e deposit products, with a maximum AUD 10,000 
balance 


ο payment products, if issued by an authorized 
deposit-taking institution (ADI) and with a 
maximum AUD 10,000 balance 


1 “Wholesale client" is defined in the Corporations Act 2001 (Cth). A retail client is 
a client that is not a wholesale client. 





ο general insurance, for personal property and home 
contents and with a maximum of AUD 50,000 insured 


ο liquid investments, for listed Australian securities or 
simple schemes and with a maximum AUD 10,000 
exposure 


e Consumer credit contracts with certain features, 
and a loan size of between AUD 2,001 and AUD 
25,000 


There are no specific admissibility requirements for 
businesses seeking individual relief. However, ASIC has 
made it clear that it is unlikely to provide individual 
relief where a business has more than 100 retail clients 
or where granting relief would put consumers at 

risk. ASIC has advised they will accept and consider 
applications for relief to vary any of the conditions 
applying to the fintech exemption. 


Businesses which seek to rely on ASIC's existing 
exemptions must meet the criteria set out in the 
relevant ASIC class order or legislative instrument. 
Foreign financial services, providers who are already 
regulated in jurisdictions outside Australia, often rely 
on the “passporting exemptions’, noting that the 
passporting exemptions apply only to the provision of 
financial services to wholesale clients. The passporting 
exemptions expired on 30 September 2019. Entities 
already relying on these exemptions prior to expiry 
will have the benefit of a two-year transition period. 


What are the main benefits of the sandbox? 


The sandbox allows businesses to enter the Australian 
market with unprecedented speed. 


Normally, businesses will have to obtain an AFSL or 
ACL before they can test their products or services. 
This process can take several months (for example, 

the standard processing time for an AFSL application 

is five to eight months). The sandbox exemptions 
allow businesses to begin testing their products 
immediately and to enter the market while applying 
for the necessary licenses. Products and services can be 
developed and improved before spending the money 
and time involved in obtaining a license. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


A common predicament facing new entrants seeking 
to obtain an AFSL or ACL are the organizational 
competency requirements involved. The licensing 
exemption enables new fintech entrants to start 
business in the Australian market without having to 
necessarily meet the high threshold of training and 
qualification for responsible managers. 
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No formal application is needed to rely on the fintech 
licensing exemption. 


However, an entity must give written notice to ASIC 
informing it of the intention to rely on the exemption. 
You must also provide company and contact details 
and a description of the services or products to be 
provided to consumers, bankruptcy and criminal 
history checks, along with a description of the 
procedures, memberships and arrangements through 
which the business will meet their dispute resolution 
and compensation obligations, and the names of any 
persons (other than employees or directors) who will 
be responsible for making significant decisions about 
the ongoing provision of the financial services or credit 
activities. Following receipt of this information, ASIC 
will then advise the business as to whether they are 
eligible to rely on the exemption. The testing period 
begins 14 days after the initial notice is provided to 
ASIC. ASIC's Innovation Hub has taken a facilitative 
approach, allowing fintech businesses, which are 
considering reliance on individual relief, to discuss their 
proposals with representatives from the Innovation 
Hub before lodging an application for relief. Businesses 
should first consider arranging a call or meeting 

with the Innovation Hub. To apply for individual 

relief, businesses must submit a written application 
electronically and include the prescribed fee. The 
application process for ASIC's existing exemptions 
varies. Businesses wishing to rely on one of these 
exemptions should consult the relevant class order or 
legislative instrument and ASIC Regulatory Guides 51 
and 257 


When to apply to be in the sandbox? 


Anytime. Neither the provider nor a related body 
corporate can use an exemption for a second time to 
test the same kind of financial service for the same 
type of financial product, or to test the same credit 
activity. 


What are the evaluation criteria? 


On the whole, ASIC is largely concerned with balancing 
the protection of consumers and maintaining consumer 
trust, as well as driving innovation in Australia. For 
existing ASIC exemptions and individual relief, ASIC 

will consider whether the commercial benefits of 
granting relief outweigh the regulatory detriments. 

For the fintech licensing exemption, ASIC will have 
regard to the type of product or service the business 

is providing. In relation to financial services, the 
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FAQS ON FINTECH REGULATORY SANDBOXES 


4 How to apply to be in the sandbox? 


exemption will apply to businesses providing financial 
product advice or dealing in financial products. It 

will not apply to businesses seeking to issue financial 
products. The type of financial products eligible are 
payment products issued by authorized deposit-taking 
institutions (with a maximum of AUD 10,000 balance), 
deposit products (with a maximum of AUD 10,000 
balance), listed Australian securities or simple schemes 
(with a maximum AUD 10,000 exposure) and general 
insurance products for personal property and home 
contents (with a maximum of AUD 50,000 insured). 


In relation to credit activities, the fintech licensing 
exemption will apply to businesses acting as an 
intermediary or providing credit assistance for credit 
contracts which have a loan size not more than AUD 
25,000, a maximum annual rate of 24% and are not 
consumer leases or subject to certain responsible 
lending obligations. 


How long will the regulators take to process 
sandbox application? 


The testing period under the fintech exemption 
begins 14 days after the initial notice of intention 

to rely on the exemption is provided to ASIC. As a 
general rule, ASIC will take approximately three to 
four weeks to process an application for existing class 
order and legislative instrument relief. It is likely that 
an application for individual relief by a new entrant 
fintech business may take a bit longer. ASIC may 
consider such applications “new policy applications” 
and may seek out their own legal advice on the extent 
of relief sought. 


What is the duration of the sandbox? 


Twelve months for the fintech licensing exemption. 
However, ASIC will consider applications for an 
extension of the testing period for an additional 12 
months. Though not prescribed, it is likely to be the 
Same length of time for individual relief. 


Separate durations may apply for ASIC's existing 
exemptions. 
What happens after the sandbox? 


The exemption can no longer be relied upon. 
Businesses should ensure that they apply for an ACL or 
AFSL during the exemption period, before the testing 
period expires. 


Any other issues to be mindful of? 


N/A. 


BE cecum '. 


ay Who can apply to be in the sandbox? 


Unlike many other countries, Belgium does not have 

a regulatory sandbox for fintechs, nor are there 
currently any plans to introduce a sandbox in the near 
future. Nevertheless, fintech has been identified as 

an important supervisory focus for the main Belgian 
financial regulators. The National Bank of Belgium 
(NBB) and the Financial Services and Markets Authority 
(FSMA) have jointly set up a unique Fintech Contact 
Point, which allows fintechs to enter into contact 
with the supervisory authorities through one single 
point of entry. 


The Fintech Contact Point was established by the 
FSMA in 2016 and evolved into a joint portal with 
the NBB in April 2017, thus creating a single point 
of contact for fintechs. 


ra What are the main benefits of the sandbox? 


The Fintech Contact Point operates as a “sound box" 
and not as a regulatory sandbox. It is a practical 
communication tool that can be used by fintechs 

to easily get in touch with the supervisory authorities. 
It is mainly used to informally discuss regulatory issues, 
questions or concerns that fintechs may have with 
respect to the services they (intend to) provide in 
Belgium and the corresponding regulatory framework 
that applies to such services. It also allows the Belgian 
regulators to follow any new fintech developments or 
changes on the Belgian market. 


ο What are some of the examples of how Fis may 
benefit from the sandbox? 


The Fintech Contact Point provides an opportunity 
for fintechs to enter into direct contact with the 
Supervisory authorities, allowing them to ask any 
questions they may have in relation to the financial 
regulatory framework with regard to their business. 


It provides a single entry point to the FSMA and the 
NBB simultaneously, which is particularly helpful for 
those fintechs that may be unaware of, or uncertain 
about, the division of competences between the 
NBB and FSMA, as laid down by Belgium's Twin 
Peaks supervisory model. The FSMA and the NBB 
jointly manage questions lodged with the Fintech 
Contact Point. 


The Fintech Contact Point is therefore a useful tool for 
fintechs to ask questions regarding the provision of 
certain innovative financial products or services and 
the corresponding licensing or authorization regimes 
that may be triggered when providing or offering such 
services in Belgium. 


- 





According to the FSMA's most recent annual reports, 
numerous valuable contacts between fintechs and the 
authorities have been held through the Fintech Contact 
Point. These contacts have mainly focused on the 
exchange of information. 


How to apply to be in the sandbox? 


The Fintech Contact Point is accessible online through 
the websites of the NBB and the FSMA. 


A short questionnaire must be completed and 
submitted online, which consists of contact details and 
some basic information about the applicant and its 
activities etc. 


The portal also allows applicants to immediately 
request and schedule a meeting with the FSMA or the 
NBB. The FSMA and the NBB aim to revert within three 
business days as of the application. 


When to apply to be in the sandbox? 


Please refer to question 4. 


What are the evaluation criteria? 


The Fintech Contact Point is available for all Belgian 
and foreign fintechs that wish to enter into direct 
contact with the NBB and the FSMA, without 
restriction. According to the NBB and the FSMA, 
fintechs include both start-ups and established firms 
that use technology to offer innovative processes, 
products or services in the financial sector. As examples 
of issues considered relevant for the Fintech Contact 
Point, the regulators refer to crowdfunding, distributed 
ledger technology, virtual currencies, APIs (application 
programming interfaces), alternative distribution 
models and robo-advice. This list is not exhaustive, 
however. The Fintech Contact Point is open to both 
licensed or authorized fintechs and those that are 
contemplating making an application for a license 

or authorization. 


How long will the regulators take to process 
sandbox application? 


N/A 


What is the duration of the sandbox? 


N/A 
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FAQS ON FINTECH REGULATORY SANDBOXES 
ε απ 


What happens after the sandbox? 


N/A 


Any other issues to be mindful of? 


Even though Belgium does not host an actual 
regulatory sandbox, it remains fintech friendly and 

can even be considered as a fintech hotspot. A 

number of the EU's legislative bodies are established 

in Belgium, such as the European Commission, the 
European Council and one of the seats of the European 
Parliament. This provides for opportunities to enter 
into immediate dialogue and react quickly to any 
proposed regulatory changes. The presence of large 
international financial institutions such as Euroclear, 
SWIFT, Lloyd's of London and The Bank of New York 
Mellon SA/NV has also attracted financial institutions 
and fintechs to Belgium due to the local expertise they 
provide. 
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Both the FSMA and the NBB also tend to be very 
approachable and supportive of new fintech initiatives. 
For example, the NBB accepts licensing applications 
submitted not only in an official language of Belgium 
but also in English. The implementation of the EU's 
Second Payment Services Directive (PSD2) and 

the impending Brexit have led some UK financial 
institutions, including fintechs, to relocate to Belgium 
and, accordingly, to establish a new passporting hub 

in Belgium. 


In August 2019, the NBB issued a press release stating 
that there has been significant growth in Belgium in 
the payments industry, mainly as a result of Brexit and 
PSD2. Eight new Belgian payment institutions were 
authorized and licensed by the NBB during the first 
eight months of 2019, bringing the total number of 
Belgian licensed payment institutions to 34. Five years 
ago, there were only 21 licensed payment institutions. 


ΠΠ Who can apply to be in the sandbox? 


The Canadian Securities Administrators (CSA) is the 
umbrella organization for Canada’s 13 provincial and 
territorial securities regulators which regulate the 
Canadian capital markets. The CSA Regulatory Sandbox 
is open to business models that are innovative from a 
Canadian market perspective. Applicants range from 
Start-ups to well established companies. Innovative 
business models have included online platforms 

such as crowdfunding portals, marketplace lenders, 
angel investor networks, any business models using 
artificial intelligence for trades or recommendations, 
cryptocurrency or distributed-ledger technology-based 
ventures and technology service providers to the 
securities industry. 


The Ontario Securities Commission (OSC), which 
oversees Canada’s largest capital market, has 
developed the OSC LaunchPad to engage fintech 
businesses and help them navigate regulatory 
requirements. In order to engage the OSC LaunchPad 
resources, a fintech firm must meet eligibility criteria 
which include: 


e where operations have not yet started or those 
where an application has been made to the OSC 
for registration or exemptive relief 


ο having a new innovation or a significantly different 
product, service or application from those currently 
available 


e the innovation will likely provide identifiable 
benefits to investors 


ο understanding the necessity of investor protection 
and investing the time and energy in 
understanding and addressing these issues 


ο acknowledging the application of securities 
laws and having considered how it applies 
to its business 


As of March 2019, the OSC LaunchPad has provided 
regulatory support to 74 fintech firms, including 
initial coin offerings, investment fund managers 
for cryptocurrency investment funds and an online 
platform facilitating venture capital and angel 
investing in start-ups. 


The Financial Services Regulatory Authority of Ontario 
(FSRA), which regulates Ontario's non-securities 
financial services including insurance, pensions, loan 





and trust corporations, announced in 2017 that it plans 
to create a “regulatory super sandbox’, consisting of 
new rules exempting certain companies from some 
requirements and to facilitate experimentation with 
new business models and products. The Ontario 
government hopes to have this regulatory super 
Sandbox operational when the transition to the new 
FSRA is complete in 2019. 


What are the main benefits of the sandbox? 


The CSA Regulatory Sandbox allows fintech firms to 
register and/or obtain exemptive relief from securities 
law requirements that may be an impediment to their 
business model. If the fintech firm seeks to operate 

in multiple Canadian jurisdictions, registration under 
the CSA Regulatory Sandbox can be made under the 
passport regime, giving the fintech firm access to 
capital markets in multiple Canadian jurisdictions. 


The OSC LaunchPad helps fintech firms avoid costly 
regulatory surprises and accelerate time-to-market, by 
providing coordination and flexibility in how they meet 
their regulatory obligations, all the while ensuring the 
OSC mandate to provide protections to investors and 
promote confidence in Canadian markets is upheld. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


Large or established financial institutions can still 
benefit from the flexibility of the sandbox system to 
help advance their offerings to customers through 
innovative products and services. For example, a 
fintech firm that is currently registered with a Canadian 
regulator, or a large financial institution subject to 
securities law requirements that has developed an 
innovative business model, would be eligible to apply 
to the CSA Regulatory Sandbox. 


How to apply to be in the sandbox? 


Fintech firms should contact the securities regulator in 
the jurisdiction where their own head office is located. 
In Ontario, this first step starts with the completion of 
an online request for support (RFS) form. 


When to apply to be in the sandbox? 


A fintech firm should apply to a regulatory sandbox 
when its service, product or application has a business 
plan, is prepared for live environment testing and has 
developed appropriate controls and investor protection 
Safeguards. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
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What are the evaluation criteria? 


A fintech firm will have its business model analyzed by 
its local securities regulator on a case-by-case basis. 


How long will the regulators take to process 
sandbox application? 


CSA staff will review applications on an expedited 
basis. In Ontario, the timeline after a RFS form is 
submitted is generally as follows: 


ο 2days - OSC will acknowledge the receipt of a 
fintech firm's RFS within two working days. 


ο 10 days — OSC will conduct an eligibility review 
within 10 working days. If the fintech firm is 
eligible, the OSC LaunchPad support team will 
reach out to schedule a meeting. If the fintech firm 
is not eligible, the OSC LaunchPad support team 
will provide feedback as to why the business does 
not meet OSC requirements. 


ο 20 days - OSC will provide direct support within 
20 working days, which includes a telephone call or 
in-person meeting with an OSC LaunchPad support 
team member. 


ο 40 days - If the fintech firm is eligible to receive 
continued support, the next steps will be taken 
within 40 working days. This may include providing 
the OSC LaunchPad support team with additional 
materials or a filing with the OSC within 20 
working days. 


What is the duration of the sandbox? 


Registration and exemptive relief granted to fintech 
firms in the CSA Regulatory Sandbox will be time 
limited. The time limit will be determined on a case- 
by-case basis. Other limits and conditions can be 
imposed to protect investors, including compliance and 
reporting obligations. 
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ΕἸ What happens after the sandbox? 


If a fintech firm agrees to the CSA Regulatory 
Sandbox's tailored program, it will receive 
authorization to operate in Canadian markets subject 
to limits and conditions. Such limits include a time 
limit on prospectus or exemptive relief. When the 
prospectus or exemptive relief expires, the fintech firm 
must complete the required filings (i.e., prospectus 

or registration filings) in order to operate under the 
applicable securities laws for its jurisdiction. 


Any other issues to be mindful of? 


Ontario is viewed as a fintech innovation hub with a 
positive and supportive environment for investment. 
The Toronto-Waterloo fintech corridor is part of the 
second largest IT cluster in North America. Located 
in southern Ontario, just north of the US border, this 
100 km stretch has over six million people living and 
working in the area. Fintech firms should consider if 
and how prospectus, registration and/or marketplace 
requirements apply to their offering, technology or 
Service. 


Securities regulation may apply to a fintech firm's 
business if it involves: 


ο digital platforms that connect investors with 
companies seeking to raise capital 


ο initial token offerings (ITOs), initial coin offerings 
(ICOs), crypto-asset trading platforms, exchanges or 
marketplaces, or crypto-asset funds and fund 
management 


e investor networks and organizations and the 
platforms that support them 


e lending platforms that allow investors to fund 
loans (or portions of loans) 


e technology and/or data-driven investment 
activities or advice, including online advice 


see] GERMANY 


ΓΙ Who can apply to be in the sandbox? 
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HONG KONG 





The Federal Financial Services Authority (Bundesanstalt 
fur Finanzdienstleistungsaufsicht) (BaFin) takes the 
approach that regulation must be applied equally to 
traditional business models and innovative forms of 
delivery of financial services. Therefore, no sandbox 

or similar feature is available for fintech companies 

in Germany. Consequently, licensing requirements 

for fintechs do not differ from conventional financial 
services. Under the current philosophy of BaFin and 
the Federal Ministry of Finance (the same regulation 
applies for everyone to create a level playing field), it is 
unlikely that a sandbox regime would be established in 
Germany anytime soon. 


What are the main benefits of the sandbox? 


N/A. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


N/A. 


How to apply to be in the sandbox? 


N/A. 


When to apply to be in the sandbox? 
N/A. 


Who can apply to be in the sandbox? 


Banks authorized by the Hong Kong Monetary 
Authority (HKMA) can apply to be in the sandbox 
operated by the HKMA. 


Firms licensed by the Hong Kong Securities and Futures 
Commission (SFC) and start-up firms that intend to 

be licensed by the SFC can apply to be in the sandbox 
operated by the SFC. 


Insurers authorized by the Hong Kong Insurance 
Authority (IA) can make applications to the IA under 
the |Ας insurtech sandbox. In addition, a licensing 
fast track for online-only insurance companies has 
been introduced. 


6 





What are the evaluation criteria? 


N/A. 


How long will the regulators take to process 
sandbox application? 


N/A. 


What is the duration of the sandbox? 


N/A. 


What happens after the sandbox? 


N/A. 


Any other issues to be mindful of? 


BaFin has created a dedicated section on its website 
with detailed information on how regulation applies 
to several different “types” of fintech business models. 
The section is available in English here. Moreover, BaFin 
has developed a specific contact form that allows 
fintech companies to submit questions regarding their 
business model, and BaFin has promised to respond at 
short notice. The contact form can be accessed here 

(in German). 


If a firm intends to conduct a pilot trial of a cross-sector 
fintech product, it may apply to seek access to the 
Sandbox it considers most relevant. The sandboxes of 
the HKMA, the SFC and the IA are linked up so that there 
is a single point of entry, if needed, for pilot trials. The 
relevant regulator will act as the primary point of contact 
and assist in liaising with the other regulators for the 
firm to access the other sandboxes concurrently. A cross- 
border pilot testing arrangement is also being explored 
by the HKMA, which links its sandbox with similar pilot 
testing facilities of overseas supervisory authorities. 

The Global Financial Innovation Network, a group of 
international organizations including the HKMA, has 
invited applications from firms wishing to test innovative 
financial products, services or business models across 
more than one jurisdiction. 
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>] What are the main benefits of the sandbox? 4 How to apply to be in the sandbox? 


Banks that wish to be in the HKMA's sandbox should 


Banks which operate within the ΗΚΜΑ͂5 sandbox are 
allowed to conduct a pilot trial of their initiatives 
involving actual banking services, without the need 
to achieve full compliance with the HKMA‘s usual 
supervisory requirements during the trial period, 
subject to certain parameters. 


The SFC's sandbox aims to enable qualified firms, 
through close dialogue with and supervision by the 
SFC, to identify and address any risks or concerns 
associated with their regulated activities before their 
services can be provided to the wider public in Hong 
Kong. To minimize risk exposure to investors, the 

SFC may impose licensing conditions such as limiting 
the types of clients these firms serve or each client's 
maximum exposure. In addition, they are expected to 
have adequate investor protection measures in place. 


Insurtech applications will be considered by the ΙΑ 
as to whether they can broadly meet the relevant 
supervisory requirements, without the need for full 
compliance. The “fast-track” process expedites the 
authorization process of the IA. 


What are some of the examples of how Fils may 
benefit from the sandbox? 


Banks which operate within the ΗΚΜΑ͂5 sandbox 

will be able to conduct more timely live tests of their 
fintech initiatives before their formal launch. This will 
enable them to gather real-life data and user feedback 
on their new fintech products or services more easily 
in a controlled environment, so that they can make 
refinements to them as appropriate. 


Firms which operate within the SFC’s sandbox will be 
able to, through close dialogue with and supervision 
by the SFC under the licensing regime, readily 
identify and address any risks or concerns relevant 
to their regulated activities. The SFC is also exploring 
a conceptual framework to license and regulate 
virtual asset trading platforms (commonly known 

as cryptocurrency exchanges) by placing interested 
virtual asset trading platform operators that have 
demonstrated a commitment to adhering to expected 
Standards in the SFC’s sandbox. During the initial 
exploratory stage within the sandbox, the SFC will 
assess whether platform operators are appropriate to 
be regulated. 


Insurers testing new insurtech initiatives within the 
Sandbox can gain real market data and information 
of user experience in a controlled environment before 
launching them into the market. 
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write to the HKMA at hkma_sandbox@hkma.gov.hk. 


Firms that wish to be in the SFC’s sandbox should get 
in touch with the SFC Fintech Contact Point (which is 
part of the function of the Licensing Department of 

the Intermediaries Division of the SFC) by completing 


the Fintech Enquiry Form. 


Insurers that wish to be in the ΙΑς sandbox (either via 
the normal or fast-track method) should write to the 
Insurtech Facilitation Team at insurtech@ia.org.hk. 


When to apply to be in the sandbox? 


Anytime. Applicants should have completed their own 
due diligence and evaluation on how they will meet 
the objectives and principles of the sandbox and the 
evaluation criteria prescribed by the regulators, as they 
are required to demonstrate how they will meet these 
requirements in the application. 


What are the evaluation criteria? 


Banks that are allowed to use the HKMA's sandbox, 
should ensure that: 


(i) Boundary: There are clear definitions about the 
scope and phases (if any) of the pilot trial, timing 
and termination arrangements. 


(ii 


Customer protection measures: Adequate measures 
will be put in place to protect the interests of 
customers during the trial, including proper 
process for selecting customers who understand 
the associated risks and voluntarily join the trial, 
enhanced complaint handling procedures, a 
mechanism for timely and fair compensation of 
customers: financial losses caused by any failures 
of the trial, and appropriate arrangements for 
customers to withdraw from the trial. 


(ili) Risk management controls: Compensating controls 
to mitigate the risks arising from less than full 
compliance with supervisory requirements and the 
risks posed to the bank's production systems and 
other customers. 


(iv) Readiness and monitoring: Readiness of the 
systems and processes involved in the trial and 
close monitoring of the trial. 


HONG KONG (cont'd) 


The SFC's sandbox is available to firms that are fit and 
proper, utilize innovative technologies and are able 

to demonstrate a genuine and serious commitment 
to carry on regulated activities through the use of 
fintech. The establishment or activities of these firms 
should also increase the range and quality of products 
and services for investors and benefit the Hong Kong 
financial services industry. 


The following principles apply to the IA’s sandbox: 


(i) Well-defined boundary and conditions: There 
should be a clearly defined scope with regard 
to the trial, including timing and duration (or an 
expected official launch date of the initiative to 
the market), size and type of insurance business, 
and targeted users, the technology involved 
and the expected outcome and success criteria 
of the trial. 


(ii) Risk management controls: There should 
be adequate control procedures to achieve 
the objectives of the relevant supervisory 
requirements of the ΙΑ. 


(ili) Customer protection: Adequate safeguards should 
be in place to protect the interests of customers 
during the trial. 


(iv) Resources and readiness of the insurer: The insurer 
should be ready for the test in the sandbox 
with adequate resources and should be able to 
demonstrate that the insurtech initiative is ready 
for testing. 


(v) Exit strategy: The insurer should present to the 
ΙΑ an exit strategy for the pilot run if it has to be 
terminated without success. 


How long will the regulators take to process 
sandbox application? 


The regulators do not specify any particular timeframe 
for the processing of sandbox applications. 


What is the duration of the sandbox? 


Variable duration. 


What happens after the sandbox? 





Banks may proceed to formally launch their services 
and products on a broader scale provided that they 
can comply with supervisory requirements applicable 
outside the sandbox regime. 


In respect of firms operating in the SFC’s sandbox, once 
a qualified firm has demonstrated that its technology 
is reliable and fit for purpose, and its internal control 
procedures have adequately addressed the risks 
identified, the firm may apply to the SFC for removal 
or variation of some or all of the licensing conditions 
imposed, so that it may conduct regulated activities 
and be subject to supervision by the SFC on the same 
basis as licensed corporations which operate outside 
the sandbox. If the SFC considers that a qualified 

firm operating in the sandbox is not fit and proper 

to remain licensed, its license may be revoked. 


Similarly, insurers may proceed to formally launch 

their services and products on a broader scale provided 
that they can comply with supervisory requirements 
applicable outside the sandbox regime. 


10 Any other issues to be mindful of? 


Generally speaking, the regulatory sandbox is not to 
be used by financial institutions as a means to bypass 
applicable supervisory requirements. 


Financial institutions and fintech players should 

be mindful of licensing issues and the regulatory 
landscape in jurisdictions outside Hong Kong, if the 
solution targets or has the potential to reach a wider 
range of customers. 


Other legal issues, such as data privacy, data transfers, 
cyber security, enforceability of e-contracts, and 
consumer protection laws, are also often prevalent 

in the use of big data, artificial intelligence/machine 
learning, distributed ledger/blockchain, cloud 
computing and e-payments. These issues cut across 
other regulators and agencies, so financial regulations 
cannot be considered in isolation. 
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Regulated financial services institutions (e.g., banks, 
securities Companies, insurance companies, pension 
funds, finance companies), unregulated companies 
looking to provide financial services that are or 

are likely to be regulated by the Financial Services 
Authority (Otoritas Jasa Keuangan) (OJK), and 
unregulated companies looking to operate financial 
technology in the payment system services that are 
or are likely to be regulated by Bank Indonesia (BI). 


Companies registered with BI are often called “fintech 
operators (penyelenggara teknologi finansial)", while 
those that fall within the scope of OJK’s regulation 
on digital financial innovation in the financial services 
sector are referred to as “digital financial innovation 
operators (penyelenggara inovasi keuangan digital)”. 


Although Bl’s and OJK's scoping and categorization of 
fintech operators overlap to some extent, it is worth 
noting that after the OJK issued the regulation on 
digital financial innovation in August 2018: (i) activities 
in the payment system space are captured by Βς 
regulation on fintech, while (ii) activities in financial 
services, including transaction settlement (not payment 
system-related), investment management, capital 
raising, fund raising and lending, and market support, 
fall within the scope of OJK'’s regulation on digital 
financial innovation. Having said that, we have seen 
entities with registrations at both the OJK and BI that 
typically engage in the financial/market aggregator 
business model, credit scoring or e-KYC. 


In a nutshell, Bl and OJK consider an applicant or an 
operator to be worthy of being placed in a sandbox if 
these criteria are met: (i) whether the entity has been 
registered as a financial technology operator (with BI) 
or as a digital financial innovation provider (with OJK) 
or if the relevant supervisory unit within BI or OJK 
recommends sandboxing, (ii) that the business model 
presented is innovative or novel, (ili) that the business 
model is scalable, or (iv) whether the entity has been 
registered with the relevant association (e.g., Indonesia 
Fintech Association). 


What are the main benefits of the sandbox? 


Bl may facilitate and allow a registered fintech operator 
to implement their business model with relative ease, 
but subject to certain limitations (e.g., area of service, 
number of customers, or period). With respect to 

OJK, registered digital financial innovation operators 
may be exempt from compliance with certain non- 
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FAQS ON FINTECH REGULATORY SANDBOXES 
ms) INDONESIA. 


ΕΙ Who can apply to be in the sandbox? 


prudential OJK regulations, subject to a sign-off 

from the relevant supervisory unit within the OJK. 
Additionally, participation in Bl’s or OJK's sandbox may 
provide a springboard for new entrants to suggest 
the direction of the regulators’ approach to updating 
the existing frameworks so as to accommodate the 
current innovations. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


The fact the product is included in the sandbox may 
give comfort to customers that the services being 
rolled out during the trial are subject to close scrutiny 
of the regulators. 


How to apply to be in the sandbox? 

The sandboxing is available at the invitation of BI 

or OJK. 

When to apply to be in the sandbox? 

Ideally, the application should be made promptly upon 
request from BI or OJK. 

What are the evaluation criteria? 


Bl and OJK will generally consider the following 
criteria: (i) worthiness and reliability of the system 
provided by the operator/applicant, and (il) observance 
of consumer protection principles, risk management 
and mitigation, and prudential principles. 


How long will the regulators take to process 
sandbox application? 


Not specified. 


What is the duration of the sandbox? 


An operator is placed in the sandbox for a maximum 
period of one year (if done under OJK) or for six 
months (if done under BI), with a potential extension 
for another six months. 


c] What happens after the sandbox? 


At the end of the sandboxing, the regulator will 

either recommend the operator for registration, order 
rectification (of aspects of their business model) within a 
period of six months, or declare that the operator is not 


to be recommended to proceed with a license application. 





Any other issues to be mindful of? 


N/A 





Who can apply to be in the sandbox? 


The regulatory sandbox is available to all firms in the 
financial, credit, insurance and regulated market sectors. 
The sandbox allows experimentation relating to fintech 
activities aimed at pursuing, through new technologies, 
such as artificial intelligence and distributed ledger 
technology, services and product innovation. 


What are the main benefits of the sandbox? 


The sandbox allows fintech start-ups to enjoy a 
simplified regulatory regime for the purpose of 
developing innovative financial/insurance solutions 
based on the application of new technologies. Each 
firm that participates in the sandbox experimentation 
is entitled to receive specific exemptions from ordinary 
regulatory regimes tailored according to their specific 
characteristics and activities, save for the need to meet 
customer and investor information and protection 
obligations, and to preserve the correct functioning 

of the market in which they operate. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


Firms are subject to reduced capital requirements and 
simplified administrative duties depending on the 
activity they perform. They are also subject to quicker 
authorization procedures (as compared with the 
ordinary regulatory procedures). 


How to apply to be in the sandbox? 


Fintech regulatory sandboxes are being introduced 
under the law of 28 June 2019 (no. 58), which amends 


Law Decree no. 34 of 30 April 2019 ("Growth Decree’). 


This sets a high-level framework for their functioning. 
The Italian Ministry of Economy and Finance is 
expected to issue detailed regulations, as indicated 

in Article 36, par. 2-quarter of the Growth Decree, on 
the perimeter of operations and applicable regulatory 
regime within 180 days of the entry into force of the 
law (1.6., by 27 December 2019). 


a 


When to apply to be in the sandbox? 


See answer to question 4. 


What are the evaluation criteria? 

See answer to question 4. 

How long will the regulators take to process 
sandbox application? 


See answer to question 4. 


What is the duration of the sandbox? 


Firms can participate for a maximum of 18 months in 
the context of strictly defined operational parameters. 
This time limit aims to prevent an indiscriminate 
disapplication of ordinary regulatory constraints. 


What happens after the sandbox? 


See answer to question 4. 


Any other issues to be mindful of? 


Firms participating in the sandbox cannot perform 
any regulated activity outside the experimentation 
parameters, although at the end of this period the 
regulatory authorities can temporarily authorize them 
to operate in the market. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
= ππππιππαα 


Who can apply to be in the sandbox? 


Financial institutions and fintech companies looking to 
provide financial services (whether on their own or in 
collaboration with financial institutions) are likely to be 
regulated by Bank Negara Malaysia (BNM). 


What are the main benefits of the sandbox? 


BNM may exempt Fls and fintech companies from 
specific regulations for the duration of the sandbox. 
This will facilitate Fls and fintech companies, which 
face challenges in meeting all regulatory requirements, 
to experiment or roll out their products and services 
under a more relaxed regulatory framework, but within 
a well-defined space and duration agreed with BNM. 


During the testing period, it is anticipated that the 
applicant will have an opportunity to engage with 
BNM by providing information on technological 
solutions/services to help improve the regulatory 
framework for the future. 


What are some of the examples of how Fils may 
benefit from the sandbox? 


Financial institutions may face challenges in 
complying fully with risk management or outsourcing 
requirements when collaborating with emerging 
technology and software companies. Existing conduct 
of business rules may not fall neatly to financial 
services that adopt artificial intelligence or big 

data solutions, which involve a substantial amount 

of automation. Fls may explore the possibility of 
relaxing some of these rules with the BNM for the 
agreed duration. 


New players looking to obtain a license, but do not 
meet the requisite track record or capital resources 
requirements, may seek exemptions from these 
requirements. 


How to apply to be in the sandbox? 


All applications must be submitted to the director 
of financial sector development of BNM using the 


prescribed form. Electronic submissions are encouraged. 
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When to apply to be in the sandbox? 


Anytime. However, applicants should have completed 
their own evaluation on the functionality of the 
product, and identified the risks posed by the product 
and the safeguards that will be implemented. The 
applicants should also have a business plan to support 
their proposed roll-out of the product. 


What are the evaluation criteria? 


BNM will consider whether the functionality of the 
product, service or solution is genuinely innovative 

to create measurable benefits to consumers and the 
industry, whether the applicant has a well-developed 
test plan and the necessary resources to support the 
test scenarios and expertise to manage potential risks, 
and whether there is a realistic business plan after exit. 


How long will the regulators take to process 
sandbox application? 


BNM endeavours to inform applicants of their 
eligibility to participate in the sandbox within 

15 working days upon receipt of the completed 
application. If the applicant is eligible, they will enter 
into a preparation stage with BNM to determine the 
parameters, measures to determine success or failure of 
the test, and a clear exit and transition strategy before 
commencement of the test period. If the participant is 
approved, it may thereafter launch its product, service 
or solution to its customers. 


What is the duration of the sandbox? 


Twelve months from the date of commencement 
unless extension is approved by BNM. 


What happens after the sandbox? 


After the sandbox expires, the participant can proceed 
to deploy the product, service or solution on a wider 
scale provided it can meet all the legal and regulatory 
requirements prescribed by BNM. If applicable, 

the graduating participant may be required to be 
licensed, or approved, by BNM in the same manner 

as traditional financial institutions. As of June 2019, 
MoneyMatch is the first to graduate from BNM's 
sandbox following MoneyMatch's approval in principle 
for a Class B remittance license, whereas an additional 
two companies, Woodpecker Asia Tech Pte Ltd (GoBear) 
and Jirnexu Sdn Bhd (RinggitPlus) are currently 
undergoing the live-testing phase. 


= MALAYSIA (cont'd) 


10° Any other issues to be mindful of? 


The sandbox framework does not apply to a proposed 
product, solution or service involving regulated 
activities under the purview of the Securities 
Commission Malaysia (e.g., fund management, peer- 
to-peer lending, equity crowd funding). A separate 
licensing and regulatory regime would apply. 


Financial institutions and fintech companies should 
also be mindful of licensing issues and the regulatory 
landscape in jurisdictions outside Malaysia if the 
solution targets, or has the potential to reach, a wider 
range of customers. 


Other legal issues, such as data privacy, data transfers, 
cyber security, enforceability of e-contracts, and 
consumer protection laws, are also often prevalent 
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ΠΗ Who can apply to be in the sandbox? 


The fintech space in the Philippines is primarily 
regulated by two governmental agencies, namely, 

the Philippine Securities and Exchange Commission 
(Philippine SEC) and the Bangko Sentral ng Pilipinas 
(BSP). Generally, the Philippine SEC regulates those 
aspects of fintech operations relating to cryptocurrency 
and related activities, while the BSP regulates fintech 
activities consisting of mobile financial services 
(including mobile lending activities and money or value 
transfer services). 


As there are no Philippine laws, rules or regulations 
establishing regulatory sandboxes, any firm proposing 
to engage in fintech activities, or the delivery of 
fintech products and services not otherwise specifically 
regulated under prevailing legislation, may properly 
apply for dispensation from either (or both) of 

the Philippine SEC or the BSP to operate under a 
Supervised and monitored regime — a quasi-sandbox. 
The decision to grant or permit such firm to operate, 
however, is purely discretionary on the part of either 
(or both) of the Philippine SEC or the BSP. 





in the use of big data, artificial intelligence/machine 
learning, distributed ledger/blockchain, cloud 
computing and e-payments. These issues cut across 
other regulators and agencies, so financial regulations 
cannot be considered in isolation. 
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o] What are the main benefits of the sandbox? 


In the absence of specific regulation, the benefits of 
operating under a regulatory sandbox (or its functional 
equivalent, assuming it is permitted by the applicable 
regulator) would depend on the terms of the sandbox 
as approved by the regulator. Generally speaking, 
participation in the sandbox, if one is permitted to be 
established, would be beneficial to its participants to 
the extent that it would allow them to identify and 
assess, ahead of going out to the wider market, the 
likely regulatory risks or issues that may arise were 

the regulator to subsequently permit such activities, 
products or services to be offered to the general public. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


At the instigation of certain players looking to establish 
virtual currency exchanges in the Philippines, the BSP 
has allowed them to operate under a supervised and 
monitored regime. Following this experience, the BSP 
subsequently issued rules and regulations governing 
the licensing and registration of the establishment 

and operation of virtual currency exchanges in the 
Philippines. 
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How to apply to be in the sandbox? 


Please refer to question 1. 


When to apply to be in the sandbox? 


N/A. 


What are the evaluation criteria? 


As the decision to establish a regulatory sandbox for 
any one or more fintech activity, product or service is 
discretionary on the part of the regulator, evaluation 
of a would-be participant or whether the activity 
could properly be the subject of a sandbox is largely 
decided on a case-by-case basis, and will depend on 
the discussions between an applicant and the relevant 
regulator. 


How long will the regulators take to process 
sandbox application? 


N/A. 


Kimm SINGAPORE 





Who can apply to be in the sandbox? 


Sandbox 


Both regulated financial institutions (Fls) and 
unregulated firms looking to provide financial services 
that are or are likely to be regulated by the Monetary 
Authority of Singapore (MAS). 


Sandbox Express 


MAS will take a phased approach by starting with 

an initial set of activities regulated by the MAS, 

and will continue to review whether appropriate 
constructs could be established to facilitate meaningful 
experiments for other regulated activities. For a start, 
Sandbox Express will be available specifically for: 


(a) insurance brokers 
(b) recognized market operators 


(c) remittance businesses 
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What is the duration of the sandbox? 


N/A. 


What happens after the sandbox? 


Based on recent experience, if the regulator 
subsequently decides to permit the relevant fintech 
activity, product or service, it will typically publish 
corresponding rules and regulations by which any 
interested party (including, of course, the participant in 
the sandbox) may properly qualify or be licensed. 


Any other issues to be mindful of? 


Although, there are no laws, rules or regulations 
Specifically governing the establishment or the 
conduct of regulatory sandboxes in the Philippines, 
the Philippine SEC and the BSP have maintained a 
relatively open approach to firms or entities who are 
seeking to conduct pilot testing of fintech products or 
Services. 


What are the main benefits of the sandbox? 


Sandbox 


MAS may exempt Fls and fintech players from specific 
regulations for the sandbox duration. This will facilitate 
Fls and fintech players that face challenges in meeting 
all regulatory requirements to experiment or roll out 
their products and services under a more relaxed 
regulatory framework, but within a well-defined space 
and duration agreed with the MAS. 


As an aside, the opportunity to engage with the MAS 
and the bilateral sharing of information may help 
shape a more practical regulatory framework in future. 
At the very least, it may lend insights into regulators’ 
expectations on the application of existing regulations. 


Sandbox Express 


Sandbox Express shortens the approval process 
for entry into the sandbox by relying on standard 
disclosures and pre-determined rules. 


Kama SINGAPORE (cont'd) 





What are some of the examples of how Fls may 
benefit from the sandbox? 


Sandbox 


Banks and other Fls may face challenges in complying 
fully with technology risk management or outsourcing 
guidelines when collaborating with emerging 
technology and software companies. Existing conduct 
of business rules may not fall neatly to financial 
services that adopt artificial intelligence or big data 
solutions that involves a substantial amount of 
automation. Banks and Fls may explore the possibility 
of relaxing some of these rules with the MAS for the 
agreed duration. 


New players looking to obtain a license but that do 
not meet the requisite track record or capital resources 
requirements may seek exemptions from these 
requirements. 


Sandbox Express 


Sandbox Express aims to complement the current 
Sandbox approach by: 


(a) providing enterprising firms carrying on certain 
activities regulated by the MAS with a faster option 
to bring innovative financial services or products to 
the market for testing 


(b) reducing the time and resources required from the 
applicants 


How to apply to be in the sandbox? 


Sandbox 


Existing Fls should approach their institutions’ MAS 
case officer. New players should write to the MAS 
Fintech Office. 


All applications must be submitted in writing, in the 
template prescribed by the MAS. 


Sandbox Express 


All applications must be submitted in writing to 


Fintech_sandbox@mas.gov.sg, in the template 
prescribed by the MAS. 


When to apply to be in the sandbox? 


Anytime. However, applicants should have completed 
their own due diligence and evaluation on how they 
will meet the objectives and principles of the sandbox/ 
Sandbox express, and the evaluation criteria prescribed 
by the MAS, as applicants are required to demonstrate 
how they will meet these requirements in the 
application. 





What are the evaluation criteria? 


Sandbox 


The MAS will consider if the solution involves the use 
of technology in an innovative way and brings benefits 
to consumers or the industry, whether the applicant 
will deploy the solution in Singapore on a broader 
scale, whether there are clearly defined test scenarios, 
expected outcomes and boundary conditions, any 
Significant risks involved and whether there is a clearly 
defined exit and transition strategy. 


Sandbox Express 


Sandbox Express is only suitable for financial services 
or products that carry risks which can be reasonably 
contained by pre-determined, standardized sandbox 
constructs. In submitting the application to enter the 
Sandbox Express, applicants agree to be bound by 
these sandbox constructs, which may be implemented 
as license conditions or exemption conditions, 
depending on the type of sandbox. 


Firms must comply with all conditions of approval, 
including providing clear and proper disclosure to 

the customer, as well as submitting regular progress 
reports to the MAS. The applicant is required to submit 
to the MAS: (a) a progress report every two months 
from the start of the approved period, and (b) a final 
progress report at the end of the approved period. 


How long will the regulators take to process 
sandbox application? 


Sandbox 


The MAS endeavors to inform applicants of their 
potential suitability for a sandbox within 21 working 
days upon receipt of the application. If an applicant is 
deemed suitable, it will then enter into an evaluation 
Stage with the MAS where the boundaries and 
duration of the sandbox are discussed and formulated. 
The MAS will inform the applicant if the sandbox is 
approved at the end of the evaluation stage. If the 
Sandbox is approved, the applicant may then launch its 
solution to its customers within the agreed parameters. 


Sandbox Express 


Eligible applicants can begin market testing in the 
pre-defined environment of Sandbox Express within 21 
days of applying to the MAS instead of taking a longer 
time to customize their sandboxes under the existing 
fintech regulatory sandbox. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
Sm SINGAPORE (cont'd) 
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For applications deemed by the MAS to be complex 
and requiring more time to assess, the MAS may notify 
the applicant within 21 days from the date of receipt 
of the application that the MAS will not consider the 
application under Sandbox Express and will instead 
treat it as an application under the current fintech 
regulatory sandbox. 


What is the duration of the sandbox? 


Sandbox 


Varies. 


Sandbox Express 


Experiments can remain in Sandbox Express for up to 
nine months. 


What happens after the sandbox? 


The legal and regulatory requirements relaxed by 

the MAS will expire. The sandbox/sandbox express 
entity can proceed to deploy the financial service on 
a broader scale provided that it is able to meet all the 
legal and regulatory requirements, and both the MAS 
and the entity are satisfied that the sandbox/sandbox 
express has achieved its intended test outcomes. 


ΝΝ 
SOUTH AFRICA 


Who can apply to be in the sandbox? 


The primary authorities governing the fintech sector 
in South Africa are the South African Reserve Bank 
(SARB) and the Financial Sector Conduct Authority 
(FSCA). These authorities have not as yet created a 
Standardized regulatory sandbox framework, however 
they have engaged on a number of ad hoc projects 


with the private sector using the concept of a sandbox. 


There are no specific laws, rules or regulations 
establishing regulatory sandboxes in South Africa. 
However, any firm proposing to engage in fintech 
activities or the delivery of fintech products and 
services, not otherwise specifically regulated under 
prevailing legislation, can engage with the SARB, or 
other relevant authority to operate under a supervised 
and monitored regime, noting that the regulator 

has shown a willingness to participate in such 
engagements. It should be noted, however, that the 
decision to grant or permit a firm to operate is purely 
discretionary at this stage. 
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10. Any other issues to be mindful of? 


Fls and fintech players should be mindful of licensing 
issues and the regulatory landscape in jurisdictions 
outside Singapore if the solution targets, or has the 
potential to reach, a wider range of customers. 


Other legal issues, such as data privacy, data transfers, 
cyber security, enforceability of e-contracts, and 
consumer protection laws, are also often prevalent 

in the use of big data, artificial intelligence/machine 
learning, distributed ledger/blockchain, cloud 
computing and e-payments. These issues cut across 
other regulators and agencies, so financial regulations 
cannot be considered in isolation. 


o] What are the main benefits of the sandbox? 


In the absence of a specific regulatory framework, 

the benefits of operating under a regulatory sandbox 
are dependent on the terms of the sandbox, as 
approved by the SARB. That being said, participation 
in sandboxes allows participants to identify and assess, 
ahead of rolling a product out to the wider market, 
the regulatory risks and/or issues which may arise. 

This also allows for early stage development under a 
relaxed regulatory environment, where otherwise such 
activities would be illegal in terms of local laws. 


What are some of the examples of how Fls may 
benefit from the sandbox? 


An example of such engagement between regulators 
and FIs is “Project Knhokha,’ which was hailed 85 a 
resounding success and which was aimed at building a 
system that handles real-time gross settlements, based 
on distributed-ledger technology. The project sought 
to replicate some of the functionality of South Africa's 
interbank settlement system, SAMOS, in a distributed- 
ledger solution called Quorum. 


συ / 
>— SOUTH AFRICA (cont'd) 


How to apply to be in the sandbox? 


Please refer to question 1. 


When to apply to be in the sandbox? 
N/A. 


What are the evaluation criteria? 


As the decision to permit and establish the sandbox 
for any fintech activity, product or service is within 

the sole discretion of the SARB (as the most active 
authority in this space), the evaluation criteria on 
permitting the sandbox are done on a case-by-case 
basis, and will accordingly depend on the contents of 
the discussions between the SARB and the firm making 
the application. 


How long will the regulators take to process 
sandbox application? 


N/A. 


What is the duration of the sandbox? 


N/A. 


What happens after the sandbox? 


Based on the recent conclusion of Project Khokha, 
following the establishment and operation of the 
regulatory sandbox, the SARB would typically decide 
whether or not to permit the relevant fintech activity, 
product or service. In this regard, the SARB will then 
issue a set of rules, regulations and guidelines by which 
any interested party may qualify for a license to be 
engaged in such activity, product or service. This is, 
however, not formalized and a different procedure 
remains within SARB's discretion. 





10. Any other issues to be mindful of? 


Reportedly, an innovation hub for the regulation of 
fintech products is set to be established by the SARB 
and the FSCA during the first half of 2020, and which 
will include a more formalized regulatory sandbox. 


Notably, the SARB, FSCA and the Financial Intelligence 
Centre, among other governmental bodies, established 
the Intergovernmental Fintech Working Group 

(IFWG), which released a consultation paper on policy 
proposals for crypto-assets in January 2019. The IFWG 
aims to, among other things, provide a platform for the 
SARB and other regulators, together with policymakers, 
to engage with industry and work towards a 
harmonized approach to regulation, and this has been 
welcomed by the SARB as being a valuable source of 
information. Among other things, the IFWG's focus 

is: (i) to consider policy and regulatory implications 

of specific fintech innovations; (ii) to collect data 

on the local fintech industry; and (iii) to assess the 
appropriateness of innovation facilitators, including a 
regulatory sandbox. 
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Swiss financial market regulators have introduced two 
Sandboxes with regulatory concessions: 


e acompletely unregulated and unsupervised 
Sandbox for persons who accept funds from the 
public of up to a total of CHF 1 million 
(‘Unregulated Sandbox’) 


e an ‘innovator license” or “banking license light" for 
persons who accept funds from the public of up to 
a total of CHF 100 million (“Innovator License’) 


e The Unregulated Sandbox can be used by anyone 
who wishes to accept funds of up to CHF 1 million. 
These are mostly fintech firms in their first market 


test phase. There are no conditions attached to this. 


However, the funds may neither be invested nor 
carry interest. Furthermore, all customers must be 
warned in writing that the business is not 
supervised by the Swiss Financial Market 
Supervisory Authority (FINMA). 


e As for the Innovator License, any company that 
meets certain minimum capital adequacy, liquidity 
and organizational requirements can apply. As with 
the Unregulated Sandbox, funds accepted from the 
public may neither be invested nor carry interest. A 
booklet with further information on the Swiss 
Innovator License can be downloaded here. 


What are the main benefits of the sandbox? 


The Swiss Banking Act generally allows the acceptance 
of monetary deposits from the public only into banks. 
Therefore, a fintech firm such as a digital payments 
services provider may not hold any deposits from 

the public unless it first obtains a banking license. 

The requirements of such a banking license are quite 
onerous and the capital, liquidity and organizational 
requirements are rarely met by start-ups. 


To create a space for younger fintech businesses 

to grow, the Swiss regulators first created the 
Unregulated Sandbox in 2017 and then in 2018 
introduced the Innovator License. These allow fintech 
firms to accept deposits from the public without 
requiring a banking license. Fintech start-ups may 
experiment on the market within the fully Unregulated 
Sandbox and then to grow further with the Innovator 
License. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
Se | SWITZERLAND 


1. Who can apply to be in the sandbox? 


What are some of the examples of how FIs may 
benefit from the sandbox? 


Fintech start-ups, such as payment platforms, can 
use the Unregulated Sandbox to test the market 
acceptance of their product. However, it should be 
noted that the limit of CHF 1 million is quite low for 8 
full market test. 


The Innovator License can be used by a wide array 

of companies, particularly from the payments and 
blockchain area. While certain initial investments are 
required, the Innovator License is a cost-effective way 
to start operating a fintech business model and to see 
it mature on the market. 


How to apply to be in the sandbox? 


As the Unregulated Sandbox is completely 
unsupervised, no registration or application is 
necessary. 


The Innovator License is granted by the FINMA. Various 
documents with general information on the business 
model and business plan, the founders, the directors 
and officers and other relevant personnel, the balance 
sheet and the organization of the company (including 
its auditor) have to be filed with the FINMA. Guidelines 
on an application for the Innovator License can be 
found on the website of FINMA. 


When to apply to be in the sandbox? 


Start-ups can use the Unregulated Sandbox as soon 
as they are operationally viable. The start-up may also 
directly apply for the Innovator License if the capital, 
liquidity and organizational requirements are met. 


What are the evaluation criteria? 


The authorities have no discretion in admitting 
companies for the Innovator License. They have to 
formally check that the relevant capital, liquidity 
and organizational requirements are met. Naturally, 
some of these requirements may vary depending on 
the specific business plan at hand. Once the FINMA 
determines that the statutory requirements are met, 
it must grant the license. Innovator Licenses are not 
limited by quotas or equivalents. 


mfa | SWITZERLAND (cont'd) 


How long will the regulators take to process 
sandbox application? 


It should take no longer than a few weeks or months 
to process the application for the Innovator License. 
This depends on the quality of the application, 

the complexity of the business model, the current 
workload of the FINMA and other factors. 


8 What is the duration of the sandbox? 


Neither the Unregulated Sandbox nor the Innovator 
License are limited in time. However, a growing 
business will soon pass the relevant deposit threshold 
of CHF 1 million and CHF 100 million, respectively. In 
certain cases, the regulator may increase the CHF 100 
million threshold. 


9 What happens after the sandbox? 


After testing a business model in the Unregulated 
Sandbox, a Swiss fintech accepting deposits from 

the public would typically move on to apply for an 
Innovator License. After it grows further and reaches 
the CHF 100 million threshold, it will have to apply 
for a banking license. In general, these requirements 
are substantially higher, but the Swiss regulators have 
recently enacted significant concessions for small 
banks. Certain grace periods are applicable for fintech 
licensees. 





10. Any other issues to be mindful of? 


The relevant deposit thresholds (CHF 1 million for 

the Unregulated Sandbox and the CHF 100 million 
deposits for the Innovator License) are calculated 

on a consolidated basis. This generally means that 
established financial institutions are unable to benefit 
from the exemption and these are lost if a bank 
acquires a fintech firm. However, the Innovator License 
allows for an exemption if it can be shown to the 
FINMA that the fintech business is in fact conducted 
independently from the financial institution's main 
business. 


In addition, it must be taken into account that the 
Unregulated Sandbox and the Innovator License are 
merely concessions from the prudential regulatory 
regime. If someone acts as a financial intermediary 

in Switzerland, i.e., as soon as someone holds or 
administers funds for another person, the Swiss anti- 
money-laundering (AML) provisions apply. This means 
that the financial intermediary must become a member 
of a self-regulatory organization or submit to direct 
Supervision by the FINMA. Certain concessions are also 
available under AML law for holders of an Innovator 
License. 
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TAIWAN 


1. Who can apply to be in the sandbox? 


A natural person, sole proprietorship, partnership, 

or legal person, looking to provide financial services 
that are or are likely to be regulated by the Financial 
Supervisory Commission (FSC), may submit an 
application to the FSC seeking approval for conducting 
an innovative experiment. 


However, there are certain qualifications for an 
applicant: for a natural person, they must be someone 
who personally or their agent has residence or domicile 
in Taiwan. For sole proprietorship or a partnership, its 
responsible person or its agent must have residence 

or domicile in Taiwan. As for a legal person, it must be 
incorporated in Taiwan or registered in Taiwan. 


What are the main benefits of the sandbox? 


While in the sandbox, an applicant may be exempt 
from certain laws and regulations in accordance with 
its proposal approved by the FSC. An applicant will 

be able to test its innovative products and/or service 
in the real market and the FSC and other government 
authorities may take the chance to reconsider 
regulations, laws and policies to see if any amendment 
needs to be made or any flexibility provided. Also, an 
applicant may request the FSC to help liaise with other 
government agencies if its business involves not just 
the market sectors regulated by the FSC. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


The first Taiwan sandbox project involved KGI Bank, a 
local bank in Taiwan, which successfully applied and 
the project ran until September 2019. In this sandbox 
experiment, KGI Bank worked with a local telecom 
company in granting personal loans to customers 
who were up to date with their telephone bills. This 
experiment was innovative because KGI Bank and the 
local telecom company conducted KYC on applicants, 
by using user behavioral analysis on their use of mobile 
phones, which was not permitted under the relevant 
regulations. 
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FAQS ON FINTECH REGULATORY SANDBOXES 


4 How to apply to be in the sandbox? 


The applicant needs to submit: (i) an application form 
and (ii) an innovation experiment plan covering the 
following items: 


(1) description of the source of funds 


(2) the financial services with which the experiment 
will be concerned 


(3) description of how the experiment is innovative, 
including whether it is a technological innovation 
or business model innovation 


(4) the scope, duration and scale 
(5) information on key officers responsible 


(6) significant clauses of the contract signed with 
participants 


(7) participant protection measures 


(8) potential risks during the experiment period and 
risk control mechanism 


(9) description of money laundering and terrorist 
financing risk assessment and risk mitigation 
measures established using a risk-based approach 


(10) IT systems used and description of security 
control operation and risk resoonse measures 


(11) expected benefits and benchmarks for measuring 
the benefits achieved 


(12) exit mechanism when the innovative experiment 
is terminated on own initiative, or cancelled or 
revoked by the competent authority, or when the 
experiment period ends 


(13) relevant information on financial technology 
patents involved, if any 


(14) cooperation agreements and description of 
relevant parties regarding their respective rights 
and obligations, if the experiment is to be 
conducted in collaboration with other individuals, 
sole proprietorships, limited partnerships or legal 
persons 


When to apply to be in the sandbox? 


The application can be made at any time once the 
application form, innovation experimentation plan and 
other related documents are completed. 





TAIWAN (cont'd) 


6 What are the evaluation criteria? 


When reviewing a sandbox application, the FSC would 
consider the following based on the scope, duration 
and scale of the proposed innovative experiment: 


(1) whether the experiment involves financial 
services that require the permission, approval or 
concession of the competent authority 


(2) whether the experiment is innovative 


(3) whether the experiment can effectively increase 
the efficiency of financial services, reduce 
operational and use costs or enhance the interests 
of financial consumers and enterprises 


(4) whether potential risks have been assessed and 
relevant resoonse measures prepared 


(5) whether participant protection measures have 
been established and appropriate compensation 
prepared; and other matters that the FSC requests 
be evaluated 


How long will the regulators take to process 
sandbox application? 


The FSC shall complete the review of a sandbox 
application and make the approval or rejection decision 
60 days after receiving the application, and will notify 
the applicant of the review decision in writing. 





What is the duration of the sandbox? 


The period of the experiment approved by the FSC 
will be limited to one year. However, an applicant 
may, one month before the approved experimental 
period ends, apply to the FSC with reasons attached 
seeking approval for an extension; the extension shall 
be limited to one occasion and for no longer than six 
months. Nonetheless, when an innovative experiment 
involves any amendment to legislation, the extension 
is not limited to one time; provided that the entire 
experiment period shall not be longer than 3 years. 


What happens after the sandbox? 


When applying to enter into the sandbox, an “exit 
mechanism’ is required to be included under the 
innovation experiment plan. If the applicant's 
experimentation proves to be a success, it may lead to 
the amendment of relevant laws or regulations. 


10 Any other issues to be mindful of? 


The sandbox mechanism in Taiwan not only provides 

a platform for innovative experimentation, but also 
for “statutory regulation clarification and consulting 
services" to assist an applicant in confirming, with 
relevant competent statutory authorities, whether or 
not its business involves the application of, or conflicts 
with any kind of laws based on their business plans. 
The applicant may decide to continue to promote the 
original business plan, or modify or change the content 
of the business plan to conform to existing laws based 
on the replies from the competent authorities. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
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o] Who can apply to be in the sandbox? 


For the Bank of Thailand's (BOT) regulatory sandbox, 
applicants can be financial institutions; companies 
within the financial business group of financial 
institutions; non-banks under the supervision of the 
BOT; fintech firms; or technology firms. However, these 
firms must be juristic persons incorporated in Thailand. 
They must have directors, executives, and employees 
with managerial powers, with specified qualifications 
and good corporate governance; and have obtained 
relevant licenses if required under applicable laws. 
Applicants should also be offering products relating 

to borrowing/lending, payment, other similar financial 
transactions or related innovation, or any other 
financial transactions approved by the BOT. 


a What are the main benefits of the sandbox? 


The BOT may exempt applicants from specific 
regulations for the duration of the sandbox, allowing 
applicants to test their innovative financial products 
and services in a live but limited environment, without 
being fully subject to all requirements that are 
normally applicable and, therefore, enable them to 
speed up the process of entering the market. For the 
BOT, it allows them to facilitate financial innovations, 
while still ensuring consumer protection and financial 
system stability, and to develop more appropriate 
regulatory policies through increased insight into new 
innovations. 


ΕἸ What are some of the examples of how Fis may 
benefit from the sandbox? 


Offering new technology, especially in the early 

Stages, may not be successful and is a high risk 

both for the operators and the public. The sandbox 
allows for such technologies to be tested in a limited 
environment before wider release. The specific lenient 
rules will depend on what the applicant states in their 
application, as the BOT will grant permission on a case- 
by-case basis. 


Additionally, offering the new technology through the 
Sandbox may assure consumers, as they will be aware 
that the technology has passed a BOT evaluation and 
remains under BOT supervision. Hence, issues like 
consumer protection measures and data security are 
heavily emphasized, and this may make consumers less 
hesitant to try the products or services. In addition, the 
Sandbox can help FIs to promote financial inclusion and 
reduce costs. 
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Examples of projects which are currently being 
implemented under the ΒΟΓ 5 sandbox, are the use 
of blockchain for letter of guarantee and cross-border 
fund transfer, use of iris recognition for identity 
verification, and QR code payment. 


How to apply to be in the sandbox? 


An applicant must submit the application form and a 
complete set of supporting documents/information, 
such as technologies to be used, the scope of the 

test (e.g., target group, transaction volume and value, 
duration), innovation tests or research results, benefits 
to the service providers, consumers and financial 
systems, consumer protection measures and regulatory 
requirements that the applicant wants to be relaxed, 
with supporting reasons, to the BOT. 


For consumer protection, the BOT specifically requires 
an applicant to maintain at least good corporate 
governance, measures regarding consumers’ money 
and assets, consumer data protection, duties to comply 
with laws on anti-money laundering and counter- 
terrorism and proliferation of weapons of mass 
destruction financing (AML/CTPF) and to maintain 
security, integrity and availability of its management 
system. 


When to apply to be in the sandbox? 


Anytime, so long as the application and its supporting 
documents are completed. 


What are the evaluation criteria? 


The BOT emphasizes that products or services must 
be innovative involving new technology not already 
available in Thailand or which will enhance the 
efficiency of existing products or services. They will 
look at the applicant's need for the sandbox and 
evaluate the research demonstrating the feasibility 
of the product or service. The BOT will also look at 
how the product or service will be beneficial for the 
ecosystem. 


How long will the regulators take to process 
sandbox application? 


The consideration process will take not longer than 45 
business days from the date on which the BOT receives 
the application and a complete set of supporting 
documents. 


παπα THAILAND (cont'd) 


ΓΙ What is the duration of the sandbox? 


Varies. The duration is as specified by the applicant in 
its test plan approved by the BOT, which should not 

be more than one year. However, the BOT is allowed 

to consider granting an extension to the test period, 
provided that the applicant applies for an extension no 
less than 30 days before the expiration date, specifying 
the reason for and period of the extension. 


9 What happens after the sandbox? 


The lenient rules will expire unless an extension period 
is granted. If the test results meet the goals initially 
presented to the BOT, the participant must submit 

an application for permission to offer the service or 
introduce the product as required by the law. If the 
goals are not met, or the applicant fails to comply 
with the conditions agreed to during participation, 
the applicant must stop the service after notifying its 
consumers, taking consumer rights into consideration, 
and submit a report detailing the cessation of services 
to the BOT within 30 days after the date of stopping 
operation. An applicant must provide the exit and 
transition plan for customers in the sandbox as well as 
the resolution plans, and how the business would be 
run or terminated if the proposed financial service or 
product is successful or has to be discontinued. 


10 Any other issues to be mindful of? 


During the test, operators must demonstrate sufficient 
consumer protection measures, risk management and 
disclosure of information, including that it is a test in 
the regulatory sandbox, as well as compliance with 
other applicable laws. Moreover, they will have to 
submit a report to the BOT on test results, indicators, 
statistical data, information on risks or errors, or the 
occurrence of dishonest acts or complaints received 
from consumers as frequently as mutually agreed 
upon, during the test and after the test is completed. 


For any fintech start-ups interested in applying for 
the sandbox, the BOT recommends they participate 

in a community, such as the Thai Fintech Association, 
in order to encourage better understanding of the 
sandbox. Additionally, fintech players should be aware 
of regulatory sandboxes provided by other regulators, 
namely, the Securities and Exchange Commission (SEC) 
and the Office of Insurance Commission (OIC). Fintech 
business operators should apply to the regulatory 
sandbox that is relevant to their products or services 
and which could be under the supervision of different 
regulators. 





The current regulatory sandboxes provided by the SEC 
comprise: 


ο a regulatory sandbox for securities and derivatives 
businesses — innovative products such as robo- 
advisers, algorithm trading, and algorithm-based 
investment advice, may benefit from this sandbox 


ο a regulatory sandbox for securities clearing houses, 
depositories and registrars, focusing especially on 
the use of blockchain technology to provide these 
supporting functions 


e aknow-your-customer regulatory sandbox, which 
is a regulatory sandbox for the e-trading platform 

Application for the OIC sandbox has been open 

since 1 June 2017 allowing insurers, agents and 

fintech/insurtech players to beta test their insurtech 

innovations. 
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The regulatory sandbox is available to all financial 
services companies looking to operate an innovative 
financial product, service or business model, whether 
Supervised players or newcomers. Such innovations 
may result from the application of technology 
(fintech), but this is not a prerequisite for qualifying for 
the sandbox, whose scope is decidedly broader than 
just fintech. The sandbox is open to all innovations 
that stand to contribute positively to a stable financial 
sector, smoothly operating financial markets and the 
sustainable financial well-being of consumers and 
investors. 


Question 6 outlines the relevant evaluation criteria to 
be eligible for the regulatory sandbox. 


What are the main benefits of the sandbox? 


The main benefit of the regulatory sandbox is that the 
Dutch Central Bank (DNB) and the Dutch Authority 
for the Financial Markets (AFM) will focus on the 

real purposes of policies, rules and regulations when 
assessing Innovative products, services or business 
models. Accordingly, if these purposes are met, the 
regulators will utilize the scope offered by the law to 
provide a bespoke solution. There could be alternative 
interpretations within the legal framework of open 
standards or a formal dispensation from specific legal 
requirements. 


Supervisors have considerable discretion in terms of 
their own policies, e.g., in the interpretation of open 
legal standards. This applies to a lesser degree to 
policies set by the European supervisory authorities. 
The Dutch regulators may deviate from European 
guidance, or interpret or impose it in a different way; 
always provided they are able to demonstrate that 
the legal and regulatory aims are being met in an 
alternative fashion. In terms of national and European 
legislation, Dutch regulators will only be able to offer 
tailored options in as much as the legislation provides 
scope to do so. 


In addition to the regulatory sandbox, the Dutch 
regulators may grant partial authorizations to financial 
services companies, in some cases for a predefined 
period. A partial authorization may be useful if a 
financial services company does not immediately 

wish to engage in all operations governed by an 
authorization and to which rules apply. Partial 
authorizations may also be permanent, for instance 
when a financial services company is a specialist niche 


player. 
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FAQS ON FINTECH REGULATORY SANDBOXES 
μα THE NETHERLANDS 


o] Who can apply to be in the sandbox? 


What are some of the examples of how Fls may 
benefit from the sandbox? 


The regulatory sandbox can extend to all forms of 
innovative financial institutions and financial services. 
The regulators in their joint report, outline a situation 
in which a financial institution has developed an 
innovative method for complying with sound and 
controlled business operation requirements utilizing 
blockchain technology. However, this new approach 
may require the enterprise to deviate from the 
prescribed rules to comply with these regulatory 
requirements. Due to the regulatory sandbox, the 
Dutch regulators can grant dispensations from these 
rigid methods and provide a bespoke compliance 
arrangement. 


How to apply to be in the sandbox? 


Provided the applicant meets the regulatory sandbox's 
evaluation criteria (discussed below), the first step is 
making contact with DNB's Innovation and organizing 
an exploratory meeting. After this meeting, the 
enterprise may submit the application for access 

to the regulatory sandbox for innovation via the 
InnovationHub. This application should contain, at 
least: 


(1) A detailed proposal for an innovative financial 
concept, showing clearly that it meets the 
evaluation criteria. 


(2) A comprehensive process proposal, specifying: 


(a) the moment at which the innovative concept 
will be introduced 


(b) the involvement of the supervisor 


(c) SMART criteria for the assessment of the 
innovative concept 


(d) measures to limit any risks during the 
application of the regulatory sandbox 


(e) adequate control measures, such as a proper 
exit plan, guaranteeing that if the innovative 
concept fails, it does not endanger the sound 
and ethical operational management of the 
enterprise 


(3) An analysis describing which rules and regulations 
constitute an obstacle and explaining why the 
innovative concept cannot be assessed via a 
Standard license application. 


For more information and informal guidance, operators 
may consult the Dutch regulatory sandbox’'s guidance. 


mm ΤΗΕ NETHERLANDS (cont'd) 


When to apply to be in the sandbox? 


The regulatory sandbox has been available since 1 
January 2017 and financial services companies are 
able to apply to the AFM and DNB at any time. Such 
requests are confidential and are treated as such. 


What are the evaluation criteria? 


The evaluate criteria for an enterprise to be provided 
access to the Dutch regulatory sandbox are as follows: 


e the enterprise cannot reasonably meet the standard 
applicable rules, regulations and guidelines to the 
letter because of Its innovative concept 


e the innovative concept meets the aim of the rules 
and regulations in spirit, i.e., the purpose of the 
rules and regulations is achieved in some other way 


ο the rules leave room for interpretation and 
customization 


e the innovative concept contributes to the solidity 
of the enterprise — to the conditions which the 
law imposes in terms of financial solidity and sound 
and ethical operational management — and does 
not jeopardize the stability of the financial system 


How long will the regulators take to process 
sandbox application? 


After the enterprise has submitted the request outlined 
under Question 4, the regulators will consider all 
interests and determine whether and how they can 
provide an appropriate bespoke arrangement, for what 
duration, which conditions will apply and how the 
regulatory sandbox will be terminated. The regulators 
have up to four weeks to evaluate the enterprise's 
application (provided all relevant documents have been 
submitted in complete form). 


What is the duration of the sandbox? 


It varies. After a successful application, the regulators 
re-evaluate at an appropriate time whether the 
bespoke arrangement will be adjusted, extended or 
terminated. 





ΕἸ What happens after the sandbox? 


When the arrangements of the regulatory sandbox 
or partial authorization expire, the enterprise can 
proceed to deploy the financial services on a broader 
scale if it is able to meet all the legal and regulatory 
requirements. 


10 Any other issues to be mindful of? 


Other legal issues, such as data privacy, data transfers, 
cyber security, enforceability of e-contracts, and 
consumer protection laws, are also often prevalent 

in the use of big data, artificial intelligence/machine 
learning, distributed ledger/blockchain, cloud 
computing and e-payments. These issues cut across 
other regulators and agencies, so financial regulations 
cannot be considered in isolation. 
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The UK Financial Conduct Authority's (FCA) sandbox 
is open to authorized firms, unauthorized firms that 
require authorization and technology businesses. 

It has proved popular, not least with fintech start- 
ups and those not yet authorized by the FCA, with 
each group, or “cohort” as they are referred to, being 
oversubscribed — roughly one in three applicants are 
accepted into any given cohort. 


Successful applicants have come from a variety of 
sectors and, reflecting the increasingly global nature 
of fintech, the sandbox has attracted participants 
from overseas companies (for example, from Canada, 
Singapore and the US) as well as the UK. The FCA note 
that the majority of applications for their most recent 
cohort came from firms looking to operate in the 
wholesale and retail banking sectors. The FCA has said 
of its latest participants that: 


e examples of accepted propositions include digital 
identity solutions, platforms which tokenize 
issuance of financial instruments, and services 
aimed at facilitating greater access to financial 
services for vulnerable consumers 


e 28% of firms are focused on blockchain or 
distributed ledger technology in order to, among 
other things: 


e automate the issuance of debt or equity 
e develop an identity verification service/platform 


e test interest-free salary advance and a cash flow 
management product 


e integrate such technology with listing and trading 
venues 


e other firms include an alternative offering to ATM, 
which operates over the LINK network and permits 
users to withdraw cash over the counter through 
using payment terminals in local shops 


ο a service aimed at reducing exclusion from the 
financial system by providing individuals with a 
proxy fixed address for use in opening basic bank 
accounts 


What are the main benefits of the sandbox? 


The sandbox seeks to provide firms with the ability to 
test products and services in a controlled environment, 
with reduced time-to-market at potentially lower 
cost, support with identifying appropriate consumer 
protection safeguards to build into new products and 
services, and better access to finance. 


It offers participants restricted authorization, individual 
guidance, informal steers, waivers and no enforcement 
action letters. Moreover, the very fact that a start- 


32 | International Guide to Regulatory Fintech Sandboxes 


FAQS ON FINTECH REGULATORY SANDBOXES 


o] Who can apply to be in the sandbox? 


up has a place in the sandbox can also provide the 
company with credibility when it is looking for 
investment or seeking partnerships with established 
financial institutions. 


The sandbox sits within a wider initiative dubbed “FCA 
Innovate,” the aim of which is to encourage innovation 
for the benefit of consumers. As part of this initiative, 
the FCA has launched two additional services — “direct 
support” and the “advice unit.” Direct support involves 
the FCA providing tailored regulatory support for 
innovative firms considering authorization. The advice 
unit involves the FCA providing regulatory feedback to 
firms developing automated models that aim to deliver 
lower cost advice to customers. We would encourage 
firms that are considering entering the sandbox to 
engage with the FCA through these services. 


Where an applicant is looking for a banking license, the 
option of restricted authorization is not available. They 
should instead contact the FCA's and the Prudential 
Regulation Authority's joint New Bank Start-up Unit. 


What are some of the examples of how FIs may 
benefit from the sandbox? 


The FCA has encouraged financial institutions to use 

the sandbox and there has been a corresponding rise 

of incumbent firms joining the sandbox in more recent 
cohorts. The sandbox can be particularly attractive 

where firms want to invest, particularly, in innovative 
technologies like DLT and blockchain, or where firms want 
to facilitate partnerships with innovative start-ups. 


How to apply to be in the sandbox? 


In the UK, the FCA accept applications to the sandbox 

on a cohort basis with two six-month test periods per 
vear. In July 2019, it was announced that 29 firms have 
been accepted into the latest (the fifth) cohort of the FCA 
sandbox (99 applied). 


Applications for cohort six are open until 31 December 2019. 


When to apply to be in the sandbox? 


The FCA advertises twice yearly for firms to join new 
cohorts. 


What are the evaluation criteria? 


In the UK, an applicant needs to meet the FCA’s default 
standards and its eligibility criteria. 


In terms of eligibility, firms need to show that they will 
deliver innovation that is either regulated business or 
Supports regulated business in the UK financial services 
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market. The FCA publishes a table on its website which 
outlines criteria against which firms can assess their 
compatibility to enter the sandbox. Factors the FCA 
consider include: 


the need to show that the innovation is ground- 
breaking or a significantly different offering in the 
marketplace 


whether the innovation offers a good prospect of 
identifiable benefit to consumers (either directly or 
via heightened competition) 


whether there is a genuine need to test the 
innovation in the FCA's sandbox 


We encourage all prospective applicants to have regard 
to this table when considering whether to make an 
application to the sandbox. 


As for default standards, the sandbox is intended for 
small-scale testing and the FCA sets strict limits to 

the size of the test. However, customer sets should be 
big enough to enable statistically relevant data to be 
obtained while managing the risk to customers and the 
practicalities of obtaining the customers for the testing 
period. The FCA will also want to ensure that firms 
have appropriate customer safeguards in place, which 
it will agree on a case-by-case basis (for example, 

retail consumers should not bear the risks of sandbox 
testing, whilst for sophisticated customers, where 
there is informed consent, their compensation might 
be limited). Some firms will need to have a UK bank 
account to be able to carry out testing. The FCA notes 
that firms which require a partner in order to test their 
proposition will need to find and secure the relevant 
contractual agreements before testing. 


Testing plans should include: 


e α plan for testing in the sandbox setting out the 
timeline and key milestones 


e measures for success for testing 

ο testing parameters (duration, customer/transaction 
limit) 

e customer safeguards 

ο risk assessment 


e exit strategy 


How long will the regulators take to process 
sandbox application? 


Normally, applications for authorization to the FCA can 
take up to six months (or longer, if the application is 
not complete). However, those made to the sandbox 
tend to be much quicker and “lighter touch" depending 
on the nature of the regulatory permission required. 





What is the duration of the sandbox? 


The FCA sandbox is intended for testing for a limited 
duration. The testing duration should be long enough 
to enable statistically relevant data to be obtained 
from the test (e.g., three to six months). 


What happens after the sandbox? 


In the UK, firms must submit a final report 
Summarizing the outcomes of the test before 
transitioning out of the sandbox. 


The FCA refers to having helped reduce the time and 
cost of getting new, innovative ideas to market and 
according to their published reports, some 90% of 
firms that have completed testing continued with their 
proposition immediately afterwards, and almost all are 
still in operation today. Of the 24 companies that the 
FCA accepted into the first cohort and tested in the 
Sandbox, 76% were still active in the UK around two 
years later. 


Following successful sandbox tests both small and large 
firms have introduced propositions to the mass market. 


Large authorized firms have tested innovations in the 
Sandbox that, following a successful test, they have gone 
on to make available to their wider customer base. 


Any other issues to be mindful of? 


There remain challenges. The FCA’s progress report 
from last year identifies various obstacles encountered 
by some sandbox participants. One of these concerns 
centers on the difficulties faced by some participants 

in obtaining key banking services in the UK, particularly 
firms wishing to leverage DLI, become payment 
institutions, or electronic money institutions. 


Crucially, acquiring customers can be an issue for 
smaller firms that enter testing without a well- 
established customer base. The FCA points to 
partnerships between large firms and start-ups in 
the sandbox as being a successful way to deal with 
this challenge. Lastly, the FCA concedes that meeting 
the threshold conditions for authorization can be 
more complex for new fintechs than for traditional 
firms. This is because their operations are structured 
differently from those which the FCA are accustomed 
to assessing. 


Another factor firms need to be aware of is that — at 
least until Brexit — the FCA cannot waive any rules 
or requirements on firms which would contravene 

EU law. This can limit the extent to which the normal 
constraints can be relaxed. 
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UKRAINE 


1. Who can apply to be in the sandbox? 


Any local or foreign company can apply to test an 
innovative financial product or service ("Solution") in 
the Ukrainian regulatory environment. The Ukrainian 
central bank (NBU) will accept applications for testing 
both currently deployed solutions as well as solutions 
in the development stage. An applicant can be either 
a licensed financial/banking or technology services 
provider or an entity contemplating applying for 
such license. 


An applicant may apply if a product/service may be 
regarded as a new financial service and/or payment 
instrument, technology platform, sales channel or an 
aggregate of the above, which has no analogy on the 
Ukrainian financial market. Alternatively, a product/ 
service may be similar to existing ones, but have some 
distinguishing features. 


ΓῚ What are the main benefits of the sandbox? 


To process an application, the NBU may engage a 
number of other competent Ukrainian authorities, 
trade associations and experts. Moreover, the NBU 
can approach the Ukrainian Government with a 
recommendation to amend legislation if it impedes 
the launch of a truly innovative solution. 


ΕἸ What are some of the examples of how Fis may 
benefit from the sandbox? 


The NBU can provide guidance on the feasibility of 
launching innovative financial products/services based 
on the requirements of current legislation of Ukraine. 


4 How to apply to be in the sandbox? 


An applicant must submit a formal application to the 
NBU, which includes a description of the applicant, 
the product/service and the implementation plan. 


ΓΙ When to apply to be in the sandbox? 


Anytime. 
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What are the evaluation criteria? 


A candidate's solution must meet a number of 
eligibility criteria, which may broadly be divided into 
product and regulatory requirements. On the product 
side, a solution should be unique or significantly 
improve available solutions, should improve user 
experience, remove friction and facilitate develooment 
of the financial market and a candidate should have a 
clear implementation plan. On the regulatory side — 
launching the solution should not violate Ukrainian law, 
including competition legislation. If its use entails risks, 
a candidate should have a risk management system 

in place. 


How long will the regulators take to process 
sandbox application? 


As a general rule, the NBU will take up to 30 business 
days to process an application from receipt of the 
submission. If the NBU considers the submission 
incomplete, it may ask the candidate to provide 
additional documents/information. 


What is the duration of the sandbox? 


This pilot program will last until the end of 2019. 


What happens after the sandbox? 


Please refer to response to question 3. 


Any other issues to be mindful of? 


This program is not designed as a classical “sandbox” 
where a product/service is actually trialed (or tested) 
within an artificial regulatory environment. It is rather 
an advisory body, which evaluates its potential and 
advises on the feasibility of implementation in Ukraine. 
As far as it is known from the market, the NBU has 
considered seven applications since the launch of 

the program. However, it is difficult to assess their 
effect, because there are no official updates as regards 
this process. 
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